Lapsus$ Gang’s Teen Members Found Guilty: Uber, Nvidia, and Rockstar Games Among High-Profile Victims

In a landmark case that highlights the growing impact of cyber-crime on global corporations, two teenage members of the notorious Lapsus$ cyber-crime gang have been found guilty of compromising the computer systems of tech giants Uber and Nvidia, while also attempting to blackmail Rockstar Games, the maker of the popular Grand Theft Auto video game series, among other high-profile victims. The verdict was reached by a jury at Southwark Crown Court in London on Wednesday, marking a significant step in the battle against cyber criminality.

The Defendants and the Unconventional Trial

Arion Kurtaj, 18, and an unnamed 17-year-old accomplice, whose identity remains protected due to legal reasons related to his age, were both found to have engaged in various criminal activities. While Kurtaj was held in custody following the verdict, the younger accomplice was released on bail, with both individuals awaiting sentencing.

This trial took an unconventional turn due to Kurtaj’s condition as an autistic individual. Psychiatric assessments deemed him unfit to stand trial, prompting the jury to focus on determining whether he had indeed committed the alleged offenses rather than rendering a traditional guilty or not guilty verdict.

The Gang’s Crime Spree

Operating within the Lapsus$ cyber-crime gang, the two teenagers were involved in a series of high-profile hacks and extortion attempts that sent shockwaves through the tech industry. Over a span of two years, between 2021 and 2022, the gang targeted telecoms giant BT, tech giants Microsoft and Samsung, mobile network provider Vodafone, fintech firm Revolut, and identity and access management company Okta.

Hacking and Extortion: The Modus Operandi

The gang’s activities began with unauthorized access to BT and EE’s servers, leading to an audacious demand for a £3.1 million ($4 million) ransom, which went unfulfilled. The hackers did, however, capitalize on stolen data, specifically SIM card details, to pilfer approximately £100,000 ($130,000) from cryptocurrency wallets belonging to five individuals.

The brazen actions of the Lapsus$ gang escalated in February 2022 when they breached the security of Nvidia, a prominent GPU manufacturer. The hackers exfiltrated employee credentials, sensitive schematics, driver and firmware code, and other valuable information. Some of the stolen data, including a private key capable of signing Windows malware, was leaked online, raising concerns about potential cyber threats.

In another striking incident, the two teenagers managed to steal unreleased content and source code for the highly anticipated Grand Theft Auto 6 video game, subsequently leaking portions of it on the internet.

International Repercussions and Legal Action

The hacking spree by the Lapsus$ gang triggered international concern, leading to the involvement of law enforcement agencies and cybersecurity experts. In March 2022, London police arrested and later released seven individuals aged between 16 and 21, suspected of being involved in the cyber attacks. However, Arion Kurtaj and his 17-year-old associate were re-arrested on March 31, 2022, following a thorough investigation.

Call for Legislative Action

The brazen actions of the teenage hackers prompted the US Department of Homeland Security’s Cyber Safety Review Board to take notice. In a recently published report, the board recommended that Congress consider funding programs focused on preventing juvenile cyber-crime and reducing criminal incentives. This recommendation aims to establish continuity between federal and state law enforcement authorities to better combat such cyber threats in the future.

Prosecution lead barrister Kevin Barry remarked that the hackers’ spree revealed a “juvenile desire to stick two fingers up to those they are attacking,” underscoring the need for more comprehensive measures against cyber-crime.

As the legal proceedings continue, the verdict against the teenage members of the Lapsus$ cyber-crime gang serves as a reminder of the challenges posed by the ever-evolving landscape of digital criminality and the pressing need for collaborative efforts to counteract its impact on society.